instar 1.3.252 → 1.3.253

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.252",
+  "version": "1.3.253",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/assemble-next-md.mjs

@@ -83,6 +83,22 @@ export function parseBumpType(content) {
   return match ? match[1].toLowerCase() : null;
 }
 
+/**
+ * Does this fragment opt into the internal-only ship lane via an
+ * `<!-- internal-only -->` marker? Such a fragment has no user-facing surface,
+ * so it may omit the "What to Tell Your User" / "Summary of New Capabilities"
+ * sections — the assembler auto-fills them ONLY when EVERY contributing fragment
+ * is internal-only (see assembleNextMd). The pre-push gate independently verifies
+ * the marker against the staged diff (an internal-only fragment whose PR touches
+ * runtime `src/` is rejected), so the marker cannot be misused.
+ */
+export function hasInternalOnlyMarker(content) {
+  return /<!--\s*internal-only\s*-->/i.test(String(content));
+}
+
+/** Canonical text auto-filled into the user-facing sections of an all-internal release. */
+export const INTERNAL_ONLY_FILL = 'None — internal change (no user-facing surface).';
+
 /**
  * Split a fragment body into H2 sections: [{ title, body }] in source order.
  * `body` excludes the heading line itself and is right-trimmed.
@@ -140,9 +156,15 @@ export function assembleNextMd(fragments) {
   const extraOrder = [];
   let maxBumpRank = 0;
   let sawAnyBump = false;
+  // The internal-only lane auto-fills the user-facing sections ONLY when every
+  // contributing fragment opts in. Starts true for a non-empty input set and is
+  // cleared by the first fragment WITHOUT an <!-- internal-only --> marker, so a
+  // single user-facing fragment keeps the full user-section requirement.
+  let allInternal = effective.length > 0;
 
   for (const frag of effective) {
     const content = frag.content ?? '';
+    if (!hasInternalOnlyMarker(content)) allInternal = false;
     const bump = parseBumpType(content);
     if (bump) {
       sawAnyBump = true;
@@ -183,6 +205,20 @@ export function assembleNextMd(fragments) {
     );
   }
 
+  // Internal-only lane: when EVERY contributing fragment is marked
+  // <!-- internal-only -->, the change has no user-facing surface, so the two
+  // user-facing sections are auto-filled rather than hand-written. This keeps the
+  // shared validator (pre-push AND publish) satisfied without forcing
+  // "None — internal" boilerplate by hand. We auto-fill ONLY missing sections, so
+  // an internal fragment that DOES say something user-facing is preserved as-is;
+  // and because `allInternal` is false whenever any fragment lacks the marker, a
+  // genuinely user-facing change that omits these sections still fails validation.
+  if (allInternal) {
+    for (const title of ['What to Tell Your User', 'Summary of New Capabilities']) {
+      if (!merged.has(title)) merged.set(title, [INTERNAL_ONLY_FILL]);
+    }
+  }
+
   // Emit canonical sections first (only when present), then extras in
   // first-seen order.
   const titleOrder = [

package/scripts/pre-push-gate.js

@@ -14,7 +14,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { validateGuideContent } from './upgrade-guide-validator.mjs';
-import { assembleNextMd, gatherFragmentInputs } from './assemble-next-md.mjs';
+import { assembleNextMd, gatherFragmentInputs, hasInternalOnlyMarker } from './assemble-next-md.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -186,6 +186,29 @@ try {
     );
   }
 
+  // ── 3c. Internal-only lane verification (objective gate) ──────────────
+  // A release fragment marked <!-- internal-only --> may omit the user-facing
+  // sections — the assembler auto-fills "None — internal" for an all-internal
+  // release. That is ONLY valid for changes with no shipped runtime surface.
+  // Verify against the diff: if any staged internal-only fragment accompanies a
+  // runtime src/ change, REJECT — a user-facing change must not skip
+  // "What to Tell Your User" / "Summary of New Capabilities". This is the
+  // objective gate that keeps the marker from being misused (the agent sets it,
+  // the diff verifies it). tests/docs/scripts-only changes are fine.
+  const internalOnlyFragments = fragmentChanges.filter(f => {
+    try { return hasInternalOnlyMarker(fs.readFileSync(path.join(ROOT, f), 'utf-8')); }
+    catch { return false; }
+  });
+  if (internalOnlyFragments.length > 0 && srcChanges.length > 0) {
+    errors.push(
+      `Internal-only release fragment(s) accompany ${srcChanges.length} runtime src/ change(s):\n` +
+      internalOnlyFragments.slice(0, 5).map(f => `      • ${f} (marked <!-- internal-only -->)`).join('\n') + '\n' +
+      `      The internal-only lane (which auto-fills the user-facing release sections) is ONLY for changes ` +
+      `with no shipped runtime surface (tests / docs / scripts). Either remove the marker and write the ` +
+      `"What to Tell Your User" + "Summary of New Capabilities" sections, or split the src/ change into its own PR.`
+    );
+  }
+
   // ── 4. Adapter contract test gate ─────────────────────────────────────
   // If messaging adapter source files changed, require contract test evidence.
   // This prevents shipping integration code verified only by mocked unit tests.

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-04T23:01:14.429Z",
-  "instarVersion": "1.3.252",
+  "generatedAt": "2026-06-04T23:12:21.750Z",
+  "instarVersion": "1.3.253",
   "entryCount": 198,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.253.md

@@ -0,0 +1,39 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added an internal-only release-note lane to the instar-dev ship gate. A release-note
+fragment that has no user-facing surface (test-only, docs-only, or build/CI scripts
+with no `src/` runtime change) can now carry an `<!-- internal-only -->` marker and
+OMIT the two user-facing sections ("What to Tell Your User", "Summary of New
+Capabilities"). The shared assembler (`scripts/assemble-next-md.mjs`) auto-fills those
+sections with "None — internal change (no user-facing surface)." — but ONLY when every
+fragment in the release is internal-only, so a real user-facing change can never skip
+telling the user.
+
+The marker is verified objectively: `scripts/pre-push-gate.js` rejects an
+`<!-- internal-only -->` fragment whose diff touches a runtime `src/` file. The
+side-effects review and decision-trace are unchanged — only the user-facing release
+boilerplate is lifted, and only for changes that provably have no user-facing surface.
+
+This very fragment uses the new lane (this PR is scripts + tests only), dogfooding it.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- 45 tests green across `tests/unit/assemble-next-md.test.ts` (auto-fill on all-internal,
+  validator passes the auto-filled guide, real content preserved when any fragment is
+  user-facing, marker detection, self-... ) and `tests/unit/pre-push-gate.test.ts` (the
+  objective §3c marker-vs-diff gate). `node --check scripts/pre-push-gate.js` clean.
+- The auto-fill lives in the assembler shared by BOTH the pre-push gate and the publish
+  gate (`check-upgrade-guide.js`), so the two can never disagree about a release note.

package/upgrades/side-effects/internal-only-ship-lane.md

@@ -0,0 +1,77 @@
+# Side-Effects Review — internal-only release-note lane (mechanism)
+
+**Version / slug:** `internal-only-ship-lane`
+**Date:** `2026-06-04`
+**Author:** `echo`
+**Second-pass reviewer:** `required (release-critical CI machinery)`
+
+## Summary of the change
+
+Every release-note fragment currently must carry all four sections — including the
+two user-facing ones (**What to Tell Your User**, **Summary of New Capabilities**).
+For a change with NO user-facing surface (test-only, docs-only, build/CI scripts with
+no `src/` runtime change) that copy is pure boilerplate ("None — internal"), which is
+disproportionate ceremony (the codex-#25 friction; the #758 telegraph test-flake fix
+had to hand-write two "None — internal" sections).
+
+This adds an **internal-only lane** (operator-approved). A fragment opts in with an
+`<!-- internal-only -->` marker and may OMIT the two user-facing sections. The
+assembler auto-fills them with a canonical "None — internal change…" ONLY when
+*every* contributing fragment is internal-only. The objective gate: the pre-push gate
+verifies the marker against the diff — an internal-only fragment whose change touches
+runtime `src/` is REJECTED. Side-effects review + decision-trace are unchanged — safety
+and auditability never get a lighter lane.
+
+This PR is the **mechanism** (assembler + pre-push verification + tests). The
+deployed-skill documentation (`skills/instar-dev/SKILL.md` + a PostUpdateMigrator
+migration to redeploy it) is a tracked follow-up.
+
+## Decision-point inventory
+
+1. **assembler auto-fill** (`assembleNextMd`): when `allInternal` (every fragment
+   marked) and a user-facing canonical section is missing from the merged map, inject
+   `INTERNAL_ONLY_FILL`. Never auto-fills when any fragment is non-internal.
+2. **pre-push verification** (`pre-push-gate.js` §3c): an internal-only fragment +
+   any `src/*.ts` change in the diff → error.
+
+## 1. Over-block (what still fails / is required)
+
+- A genuinely user-facing change that OMITS the user sections still fails: it is not
+  `allInternal` (it has no marker, or the gate rejects the marker on a `src/` diff), so
+  the assembler does NOT auto-fill, and `validateGuideContent` reports the missing
+  sections. (test: "does NOT auto-fill when any fragment is user-facing".)
+- `What Changed` + `Evidence` are still required; the Evidence-bar (fix-claim →
+  Evidence) is untouched.
+- All existing fragment validations (inline-code / camelCase / fenced-block leakage,
+  malformed fragment, bump tier) are unchanged — 25 pre-existing assembler tests +
+  the full pre-push suite stay green.
+
+## 2. Under-block (what it now allows)
+
+- An all-internal release may omit the two user-facing sections; the assembler fills
+  them. This is gated objectively: the marker is verified against the diff at pre-push,
+  so it cannot be set on a runtime `src/` change to hide user-facing impact. The agent
+  sets the marker; the diff verifies it. (test: source-presence of the §3c gate +
+  `hasInternalOnlyMarker`.)
+- Worst case of a wrong marker on a non-src change (e.g. a scripts change that DOES have
+  user impact): the publish notes say "None — internal" for that release. Bounded and
+  low-harm — scripts/docs/test changes have no agent-user runtime surface by
+  construction.
+
+## 3. Blast radius
+
+- `scripts/assemble-next-md.mjs` — pure function; new `hasInternalOnlyMarker` +
+  `INTERNAL_ONLY_FILL` exports + the auto-fill branch.
+- `scripts/pre-push-gate.js` — one new §3c check (reuses existing `srcChanges` /
+  `fragmentChanges`).
+- Tests only otherwise. NO `src/` change, no runtime/agent surface. The assembler is
+  shared by BOTH the pre-push gate and the publish gate (`check-upgrade-guide.js`), so
+  the auto-fill keeps both consistent — the change was deliberately placed in the shared
+  assembler so the two gates can never disagree.
+
+## 4. Reversibility
+
+Fully reversible: revert the two scripts + test edits. No state, no persisted format
+(the `<!-- internal-only -->` marker is just a fragment comment — a fragment without it
+behaves exactly as before). Verified: 45 tests green (assemble-next-md + pre-push-gate
+suites), `node --check` clean on the gate.